Warmerly
Customer data is hosted in the EU, per its trust page.
Warmerly
Meet Alfred
One-to-one · Where data is held
Where data is held
One row, in depth: what each tool does, the verified numbers, and who each suits.
Meet Alfred details read from its pricing page, home page, security page and help centre on 21 October 2026.
Warmerly
Customer data is hosted in the EU, per its trust page.
Meet Alfred
Amazon data centres in the US, per its security page.
The short answer
Where data is held, in one look.
Warmerly's trust page says customer data is hosted in the EU. Meet Alfred says it is hosted in Amazon data centres in the US, and that it is committed to GDPR and CCPA compliance. Meet Alfred's DPA gives 30 days' notice of a new sub-processor, longer than Warmerly's 15. Where your data sits may matter to your buyers, so check each company's own documents before you decide. Last checked 22 October 2026.
Meet Alfred
Amazon data centres in the US, per its security page.
The picture
Drawn side by side.
Where the data sits
The statements each company publishes
WarmerlyMeet Alfred
Warmerly
Customer dataHosted in the EUServices listed15 days notice
Meet Alfred
User dataAmazon Web ServicesUS data centresRegions not stated
Statements only, from each company's own pages. Warmerly's trust page says some listed services are outside the UK and EEA. Meet Alfred's security page does not say which US regions.
How Warmerly does it
Warmerly, in detail.
Warmerly states that customer data is hosted in the EU and lists the services behind it.
01
Hosted in the EU
Warmerly's trust page says customer data is hosted in the EU, and the services behind Warmerly are listed in full.
Warmerly product, checked 21 October 2026
02
Transfers
Where personal data goes to a service outside the UK and EU, the privacy policy says Warmerly relies on an adequacy decision or regulation where one covers the recipient, and otherwise on the UK addendum and standard contractual clauses.
Warmerly product, checked 21 October 2026
03
Some services sit outside the EU
The trust page says some of the services that process customer data are outside the UK and the EEA, and names the safeguards used. It also says Warmerly gives at least 15 days' notice before a new sub-processor starts and tells the account owner of a confirmed breach within 72 hours where feasible.
Warmerly product, checked 21 October 2026
04
What we did not check
This page compares published statements only. We did not audit either company's systems.
Warmerly product, checked 21 October 2026
05
Encryption at rest
Mailbox OAuth tokens, IMAP and SMTP passwords and the credentials of hosted mailboxes are encrypted at rest with AES-256-GCM, using a key held outside the database. The trust page cites the DPA, Annex 2.
Warmerly product, checked 21 October 2026
06
Passwords and keys
Account passwords are hashed with Argon2id. API keys and email and password reset tokens are stored only as SHA-256 hashes, and an API key is shown once.
Warmerly product, checked 21 October 2026
07
In transit
The website, app and API are served over TLS with HTTP Strict Transport Security. Mail to other servers uses TLS where the other server supports it.
Warmerly product, checked 21 October 2026
08
Backups
The production database and the mail servers' databases are backed up nightly, each backup encrypted with a key held off-server, and the database log is archived at least every five minutes for point-in-time recovery. Servers hold write-only backup credentials. The pages do not state a retention period for backups.
Warmerly product, checked 21 October 2026
09
Staff access
Administrators can access a customer workspace only to resolve a raised problem or investigate abuse. The access is logged, shown in the interface while it happens and expires within 24 hours.
Warmerly product, checked 21 October 2026
10
Leaving
Mailbox passwords and tokens are deleted the moment you disconnect a mailbox, the synced mail for it is deleted with it, and the privacy policy commits to 30 days at most.
Warmerly product, checked 21 October 2026
11
Roles and the audit log
Three roles per workspace (owner, admin, member), and an audit log of log-ins, failed log-ins, password and email changes, API key changes, member and role changes and mailbox connections.
Warmerly product, checked 21 October 2026
12
A sole trader, no DPO
Warmerly is run by a sole trader in the United Kingdom. No data protection officer has been appointed, and privacy matters go to privacy@warmerly.com. Meet Alfred's pages we read state neither point for itself.
Warmerly product, checked 21 October 2026
13
Warmup network visibility
Warmup exchanges real mail between mailboxes, including other customers', so a mailbox's address, display name and signature are visible to the owners of the mailboxes it exchanges mail with. The warmup terms forbid collecting those addresses.
Warmerly product, checked 21 October 2026
How Meet Alfred does it
Meet Alfred, in detail.
Meet Alfred's security page describes AWS hosting in the US, encryption and commitments to GDPR and CCPA.
01
Hosting
The security page says all services run in the cloud on Amazon Web Services, and that Meet Alfred is hosted at Amazon data centres located in the US. It does not say which regions.
meetalfred.com/security · read 21 October 2026
02
Encryption
It says user data including passwords is encrypted in the database, network traffic runs over SSL/HTTPS and backups are encrypted.
meetalfred.com/security · read 21 October 2026
03
Compliance
It says Meet Alfred is committed to ongoing GDPR compliance and to CCPA compliance. It mentions no SOC report.
meetalfred.com/security · read 21 October 2026
04
Deleting data
It says that on request it will delete all data associated with your account.
meetalfred.com/security · read 21 October 2026
05
Its DPA
The data processing agreement says the services are built on AWS, that Meet Alfred will notify the customer at least thirty (30) days before appointing a new sub-processor, and that it keeps a list of sub-processors with their locations. It gives no breach notification time in hours and does not name hosting regions.
meetalfred.com/data-processing-agreement · read 21 October 2026
06
Its GDPR page
The GDPR page says Meet Alfred acts as a processor for its customers and signs a DPA. It does not state data location, transfer mechanisms, a data protection officer or sub-processors.
meetalfred.com/gdpr · read 21 October 2026
07
Physical and access controls
The security page says its US data centres have 24/7 physical security, fire suppression, redundant utilities and biometric access, that only people who need access get it, and that production access is limited to key engineering staff.
meetalfred.com/security · read 22 October 2026
08
Backups and patching
It says critical assets are backed up and restores are tested regularly, and that systems are regularly replaced with patched versions. It gives no recovery time or recovery point targets and no backup retention period.
meetalfred.com/security · read 22 October 2026
09
Payments and DDoS
It says payments are handled by Stripe, so Meet Alfred does not collect payment information, and that DDoS protection comes from Cloudflare.
meetalfred.com/security · read 22 October 2026
10
Measures listed in its DPA
The DPA lists encryption in transit and at rest, pseudonymisation, least-privilege access, multi-factor authentication for administrative access, logging, penetration testing, disaster recovery and incident response, and says they are reviewed periodically with no frequency given.
meetalfred.com/data-processing-agreement · read 22 October 2026
11
International transfers
The DPA says transfers outside the EEA, UK or Switzerland rely on the EU standard contractual clauses (Module Two), the UK Addendum or another recognised mechanism. It does not name destination countries.
meetalfred.com/data-processing-agreement · read 22 October 2026
12
What it holds for you
The DPA's data scope includes contact details, time zone, login credentials such as LinkedIn and Gmail, IP address, device information and account settings.
meetalfred.com/data-processing-agreement · read 22 October 2026
13
Governing law and objection
The DPA is governed by English law. A customer may object to a new sub-processor on reasonable data protection grounds and, if unresolved, end the affected services without penalty.
meetalfred.com/data-processing-agreement · read 22 October 2026
What Meet Alfred does not say
We looked, and found no statement on these. That is about its published pages only, not about the product.
- A SOC 2 or similar report
- Which AWS regions it uses
- A breach notification time in hours
- Two-factor authentication or customer account controls
- An audit or inspection right in its DPA
- A deletion or return of data on termination, with a timeframe
- How LinkedIn login details are stored, beyond the DPA listing them as data held
- Single sign-on or two-factor sign-in for customer users on the security page (an integrations article mentions enterprise SSO support)
Where the sources disagree
We report each version rather than pick one.
- Meet Alfred's security page names AWS as the host in the US, while its DPA names AWS in section 5.2 but does not list it in its sub-processor schedule on the page we read. We report both.
The numbers
Only what we could verify.
| Measure | Warmerly | Meet Alfred |
|---|---|---|
| Where data is held | Customer data is hosted in the EU, per its trust page. | Amazon data centres in the US, per its security page. |
| Encryption stated | Not covered on this page | Database, traffic and backups |
| Notice of a new sub-processor | At least 15 days | At least 30 days, per its DPA |
| Breach notice | 72 hours where feasible | No hours stated in its DPA |
| SOC report | Not mentioned | Not mentioned |
| Encryption at rest named | AES-256-GCM for mailbox credentials | Database encrypted, algorithm not named |
| Backup frequency | Nightly, log archived every 5 minutes | Not stated |
| Staff access to your workspace | Logged, expires within 24 hours | Production access limited to key engineering staff |
In practice
What it means for you.
Our reading of the facts above. Not a promise, and not the only reasonable reading.
Ask what your buyers expect
If you sell to organisations that want data held in the EU, a US-hosted tool may need a conversation. If your buyers are in the US, it may not.
Read the documents
Both companies publish a privacy policy and a data processing agreement. Those, not a comparison page, are the documents to check.
This is not a rating
We do not rank security. We compare where each company says the data is held.
Your own obligations
Using either tool you are usually the controller of the people you contact. Both DPAs say so for their customers. Having a lawful basis to contact them remains your job.
Questions for a buyer's review
For Meet Alfred, ask for its sub-processor list, hosting regions, a breach notification time and any audit report. For Warmerly, ask for the sub-processors page and the DPA, and for the safeguards used where a service sits outside the UK and EEA.
Credentials are the sensitive part
Both tools hold the keys to something you care about: LinkedIn logins for Meet Alfred, mailbox credentials for Warmerly. Ask how each is stored. Warmerly says AES-256-GCM at rest. Meet Alfred's pages do not say.
Who it suits
Pick the one that fits.
Warmerly
Warmerly is the better fit if
- You want customer data hosted in the EU
- You want a published list of the services behind the product
- Your own policy prefers EU hosting
- You want encryption, backup and staff access arrangements stated in numbers and plain words
Meet Alfred
Meet Alfred is the better fit if
- Your buyers and your policy are comfortable with US hosting on AWS
- You want 30 days' notice of a new sub-processor, as its DPA states
- You use its data deletion on request
- Your security team prefers a vendor with a longer-established, larger user base, which it states as 175,000 registered users
Questions
Where does Meet Alfred host data?
On Amazon Web Services, in data centres located in the US, per its security page.
Where does Warmerly host data?
Warmerly's trust page says customer data is hosted in the EU.
Does Warmerly have a SOC 2 report?
Its trust page mentions none, and says it leaves out what it cannot confirm.
Is Warmerly's EU hosting a guarantee that no data leaves the EU?
No. The trust page says some services that process customer data are outside the UK and EEA, and names the safeguards used.
Sources
- Meet Alfred security page, read 21 October 2026
- Meet Alfred data processing agreement, read 21 October 2026
- Meet Alfred GDPR page, read 21 October 2026
- Warmerly trust page
- Warmerly plans and limits (docs)
- Meet Alfred pricing page (user count)
Meet Alfred pages were read on 21 October 2026. Plans and wording change, so check the vendor's own page before you decide. Warmerly details come from the product as it runs today.
More features
- All features
- Main job
- Starting price (per month)
- Cheapest plan with email
- Free trial
- LinkedIn automation
- Channels in one sequence
- Mailboxes you can send from
- Daily email limits and ramp
- Email warmup and deliverability
- SPF, DKIM and DMARC checks
- LinkedIn safety and limits
- Reply inbox
- Lead finding and verification
- Integrations
- Teams, roles and white label
See it on your own mailbox.
Connect a mailbox. Warmerly runs alongside whatever you send from now, so you can compare before you move anything.
Free plan, no card. Paid plans: 7-day trial, first charge on day 8.